Vault Rekey Unseal Process | HashiCorp Security

Why Vault Sealing and Unsealing Matters

When Vault starts or restarts, it enters a “sealed” state where encryption keys are not loaded into memory. This fundamental security mechanism ensures that even if attackers gain physical access to storage, encrypted data remains inaccessible without proper unseal keys.

When You Need to Unseal Vault

• After System Restarts – Vault automatically seals after any restart or service interruption
• Making Secrets Accessible – Applications need unsealed Vault to retrieve credentials and API keys
• Post-Maintenance Operations – System updates or configuration changes require unsealing for normal operations
• Recovery Scenarios – After resolving system crashes or hardware failures

Step-by-Step Vault Unsealing Process

Unsealing Vault requires multiple unseal keys based on your security threshold configuration. This distributed key approach ensures no single person can compromise your secrets management system.

Prerequisites

• Administrative access to the Vault server
• Command line interface with Vault CLI installed
• Access to the required number of unseal keys
• Network connectivity to the Vault instance

Unsealing Commands

# Check Vault status
vault status

# Begin unsealing process
vault operator unseal

# Enter first unseal key when prompted
# Vault will display: Key (will be hidden):

# Continue with additional keys until threshold is met
vault operator unseal
# Enter second key...

# Verify unsealing completed successfully
vault status
# Should show "Sealed: false"

Troubleshooting Common Unsealing Issues

Manual Vault Sealing: When and How

There are critical scenarios where manually sealing Vault becomes necessary to protect sensitive data from security threats or during maintenance operations.

When to Manually Seal Vault

• Security Breaches – Immediately seal Vault if unauthorized access is detected
• System Maintenance – Seal before major upgrades or configuration changes
• Compliance Audits – Required for certain regulatory compliance checks
• Emergency Response – Part of incident response procedures

Sealing Process

# Authenticate with Vault first
vault auth -method=userpass username=admin

# Immediately seal Vault
vault operator seal

# Verify sealing was successful
vault status
# Should show "Sealed: true"

Vault Rekeying: Advanced Security Management

Rekeying generates new unseal keys and optionally changes the key threshold, ensuring that departing personnel cannot access your secrets management system. This process is essential for maintaining security integrity over time.

When to Rekey Vault

• Personnel Changes – When employees with unseal keys leave the organization
• Security Incidents – After suspected key compromise or security breaches
• Compliance Requirements – Regular key rotation policies
• Access Control Updates – Changing the number of keys or threshold requirements

Rekeying Process

# Step 1: Initialize rekeying process
vault operator rekey -init -key-shares=5 -key-threshold=3

# Note the nonce returned - you'll need this for the process
# Output: Nonce: 2dbd10f1-8528-6246-09e7-82b25b8ded63

# Step 2: Each key holder provides their current unseal key
vault operator rekey -nonce=2dbd10f1-8528-6246-09e7-82b25b8ded63

# Step 3: Repeat until threshold is met
# Once complete, new unseal keys will be displayed

# Step 4: Verify rekeying completed
vault status

Secure Key Distribution

• Use Secure Channels – Encrypt keys during transmission, avoid email
• Separate Delivery Methods – Send keys via different communication channels
• Confirm Receipt – Verify each key holder received and stored their key securely
• Document Process – Maintain audit trails for compliance requirements

Vault Security Best Practices

Access Controls and Authentication

• Implement Multi-Factor Authentication – Require MFA for all administrative access
• Least Privilege Principle – Grant minimum necessary permissions
• Regular Access Reviews – Audit and update permissions quarterly
• Strong Authentication Methods – Use certificate-based or OIDC authentication

Monitoring and Auditing

• Enable Audit Logging – Track all Vault operations and access attempts
• Real-Time Monitoring – Set up alerts for unsealing, sealing, and failed access
• Regular Log Review – Analyze patterns and identify potential security issues
• Compliance Reporting – Generate reports for regulatory requirements

Backup and Recovery

# Create regular Vault snapshots
vault operator raft snapshot save backup-$(date +%Y%m%d).snap

# Verify snapshot integrity
vault operator raft snapshot inspect backup-20231215.snap

# Store backups in secure, off-site location
aws s3 cp backup-20231215.snap s3://vault-backups/$(date +%Y/%m/%d)/